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ICO consultation on the draft updated data sharing 
code of practice 


Data sharing brings important benefits to organisations and individuals, 
making our lives easier and helping to deliver efficient services. 


It is important, however, that organisations which share personal data 
have high data protection standards, sharing data in ways that are fair, 
transparent and accountable. We also want organisations to be confident 
when dealing with data sharing matters, so individuals can be confident 
their data has been shared securely and responsibly. 


As required by the Data Protection Act 2018, we are working on updating 
our data sharing code of practice, which was published in 2011. We are 
now seeking your views on the draft updated code. 


The draft updated code explains and advises on changes to data 
protection legislation where these changes are relevant to data sharing. It 
addresses many aspects of the new legislation including transparency, 
lawful bases for processing, the new accountability principle and the 
requirement to record processing activities. 


The draft updated code continues to provide practical guidance in relation 
to data sharing and promotes good practice in the sharing of personal 
data. It also seeks to allay common concerns around data sharing. 


As well as legislative changes, the code deals with technical and other 
developments that have had an impact on data sharing since the 
publication of the last code in 2011. 


Before drafting the code, the Information Commissioner launched a call 
for views in August 2018. You can view a summary of the responses and 
some of the individual responses here. 


If you wish to make any comments not covered by the questions in the 
Survey, or you have any general queries about the consultation, please 


email us at datasharingcode@ico.org.uk. 


Please send us your responses by Monday 9 September 2019. 


Privacy Statement 


For this consultation, we will publish all responses except for those where 
the respondent indicates that they are an individual acting in a private 
Capacity (e.g. a member of the public). All responses from organisations 
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and individuals responding in a professional capacity will be published. We 
will remove email addresses and telephone numbers from these 
responses; but apart from this, we will publish them in full. 


For more information about what we do with personal data please see our 
privacy notice. 


Questions 


Note: when commenting, please bear in mind that, on the whole, the 
code does not duplicate the content of existing guidance on particular 
data protection issues, but instead encourages the reader to refer to the 
most up to date guidance on the ICO website. 


Qi Does the updated code adequately explain and advise on the new 
aspects of data protection legislation which are relevant to data 
sharing? 


[1 Yes 


K No 


Q2 If not, please specify where improvements could be made. 


Forbes Solicitors welcomes the draft code as overall it is written very clearly and is easy to follow, 
without requiring a legal background. However, we believe our client’s would benefit from further 
explanation of how to determine a lawful basis, particularly in respect of sharing special category 
and criminal offence data. Given the complex nature of the legislation, our client’s need to be aware 
that when sharing special category data they need a lawful basis under Article 6, plus a lawful basis 


under Article 9 (or 10 for criminal offence data) plus a condition from Schedule 1 of the Data 
Protection Act 2018. We feel that this could be expanded on in the draft code and made clearer by 
providing examples of lawful basis’ for sharing information. 


Q3 Does the draft code cover the right issues about data sharing? 
Ll] Yes 


K No 
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Q4 If no, what other issues would you like to be covered in it? 


Forbes Solicitors welcomes the addition of the section of the code dealing with data sharing in an 
urgent situation or in an emergency. The common misconception that personal data cannot be 
shared without consent is something we see on a regular basis and are often contacted about for 
advice from public sector clients. The draft code makes it clear that the DPA does not prevent 
organisations from sharing personal data where necessary but this guidance is limited to 2 pages 
and appears towards the end of the code (page 80). 


We believe that our clients would benefit from more comprehensive guidance about information 
sharing in an urgent situation or in an emergency. In particular, examples of legitimate information 
sharing in an urgent situation or in an emergency would assist client’s in their decision making 
processes. For example, the Department for Education Information Sharing Guidance makes it clear 
that the Data Protection Act 2018 includes ‘safeguarding of children and individuals at risk’ as a 
condition for processing special category data in the public interest and therefore a similar example 
could be included within the draft code. 


Q5 Does the draft code contain the right level of detail? 
LI] Yes 


K No 


Q6 If no, in what areas should there be more detail within the draft 
code? 


Please see comments above — we would welcome further detail in respect of sharing special 
category and criminal offence data and further guidance relating to information sharing in an 
emergency or urgent situation. 


Q7 Has the draft code sufficiently addressed new areas or 
developments in data protection that are having an impact on your 
organisation’s data sharing practices? 


[1 Yes 


K No 
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Q8 If no, please specify what areas are not being addressed, or not 
being addressed in enough detail 


Forbes Solicitors welcomes the addition of the section of the code dealing with data sharing in an 
urgent situation or in an emergency. As the GDPR introduced the specific safeguarding of children’s 
data, our public sector clients would welcome the section in the draft code headed ‘Data Sharing 
and Children’ to be expanded. We suggest it should be made clear in this section of the draft code 
that the DPA does not prevent organisations from sharing personal data where necessary, including 
where this is to safeguard and promote the welfare of children at risk of abuse or neglect and 
confirm that the DPA includes the ‘safeguarding of children and individuals at risk’ as a condition 
for processing special category data in the public interest. 


Q9 Does the draft code provide enough clarity on good practice in data 
Sharing? 


[1 Yes 


K No 


Q10 If no, please indicate the section(s) of the draft code which could be 
improved, and what can be done to make the section(s) clearer. 


See comments above — Overall the draft code is very clearly written and is easy to follow but we 
would welcome more examples. 


Q11 Does the draft code strike the right balance between recognising 
the benefits of sharing data and the need to protect it? 


Yes 


O No 
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Q12 If no, in what way does the draft code fail to strike this balance? 


Yes — we believe that there is a need to make clear that there is a benefit to sharing information 
but this needs to be done in a way that ensures the information is protected. The use of the ‘Gangs 
Database’ example at page 35 is useful to highlight how information sharing can be in the public 
interest but the way in which it was done was inconsistent with the data protection principles. 


Q13 Does the draft code cover case studies or data sharing scenarios 
relevant to your organisation? 


[|] Yes 


K No 


Q14 Please provide any further comments or suggestions you may have 
about the draft code. 


There are no specific examples relating to the legal sector. Whilst there are a number of public 
sector examples, we would welcome further examples of information sharing in the public interest 
(e.g. to safeguard children) as discussed above. 


Q15 To what extent do you agree that the draft code is clear and easy 
to understand? 


O Strongly agree 
Agree 
Neither agree nor disagree 


Disagree 


B 
ICO. 
O Strongly disagree 


Q16 Are you answering as: 


L] An individual acting in a private capacity (e.g. someone 
providing their views as a member of the public of the public) 


O An individual acting in a professional capacity 
On behalf of an organisation 
O Other 


Please specify the name of your organisation: 


Forbes Solicitors 


Thank you for taking the time to share your views and experience. 


